CTDC study plan

Map the network kill chain by classifying each of the eight traffic-analysis categories (reconnaissance, command-and-control, exfiltration, lateral movement, tunneling, DNS abuse, TLS anomalies, beaconing) against a sample PCAP and writing one detection hypothesis per category

Dissect TCP/IP and DNS handshakes packet-by-packet in a lab capture to identify which fields (TTL, window size, JA3, query entropy, response size) carry detection value

Build a personal glossary of 30 traffic-analysis terms with a one-line operational definition and a note on where each appears in log or packet evidence

Configure a free packet analyzer to filter for beaconing patterns (regular intervals, jitter, small payloads) and document the filter syntax used

Practice reconstructing a full TCP stream from a provided capture description and extract the HTTP request line, User-Agent, URI path, and response code as structured fields

Compare encrypted versus unencrypted traffic evidence and list which metadata (certificate fields, SNI, flow duration, byte counts) remains usable when payload is unreadable

Write three detection rules in pseudocode for DNS exfiltration, long-duration low-and-slow sessions, and internal host scanning, each with the threshold and rationale

Explain the difference between flow-level and packet-level telemetry and state which questions each can and cannot answer

Enumerate the primary endpoint telemetry sources (process creation, parent-child lineage, file writes, registry changes, service installs, scheduled tasks, driver loads, network connections) and record the key fields each produces

Trace a process tree from an office document spawning a scripting interpreter to a child process making an outbound connection, annotating each node with the event type that would prove it

Distinguish persistence mechanisms on endpoints (run keys, services, scheduled tasks, WMI subscriptions, startup folders) and state the artifact that reveals each

Compare endpoint detection-and-response capabilities against traditional antivirus using at least four concrete differences in visibility and response action

Identify three ways attackers disable or evade endpoint logging and name the compensating detection for each

Classify log sources by category (authentication, endpoint, network, cloud, application) and record the fields, retention norms, and time-sync considerations for each

Normalize three sample events from different sources into a common schema (timestamp, host, user, action, source IP, outcome) and note the mapping decisions

Write a correlation rule that joins a failed-logon burst on one host with a subsequent successful logon from the same source and explain the logic and thresholds

Apply a triage framework to rank five sample alerts by severity using asset criticality, indicator confidence, and blast radius

Document the questions a first responder must answer within the first ten minutes of an alert

Distinguish tactical, operational, and strategic intelligence and state which consumer and decision each serves

Compare indicator types (IP, domain, file hash, URI pattern, certificate, behavioral indicator) on durability, false-positive risk, and ease of pivoting

Design an indicator lifecycle covering intake, enrichment, scoring, deployment, aging, and retirement, with the decay rule stated explicitly

Map ten adversary behaviors to MITRE ATT&CK technique identifiers and name the data source that would detect each

Critique a set of indicators for staleness and context gaps and rewrite two of them into behavior-based detections

Write a severity and escalation matrix that defines trigger conditions, notification path, and time targets for each tier

Draft a containment decision tree covering host isolation, account disablement, credential reset, and network segmentation, with the trade-offs of each action

Assemble an incident timeline from mixed log sources, resolving timestamp and timezone conflicts into a single narrative

Distinguish evidence-preservation steps from remediation steps and state which actions risk destroying forensic value

Draft a post-incident review template that captures root cause, detection gap, and a concrete control improvement

Select mitigation controls mapped to specific attack techniques (credential dumping, lateral movement, phishing execution, C2) and justify each with expected detection or prevention effect

Evaluate hardening baselines for endpoints and identity (least privilege, application control, logging policy, MFA) and list the trade-offs each introduces

Explain network segmentation and egress filtering as detection enablers, not just prevention, with two concrete examples

Identify three controls that generate high-value telemetry and describe the alert each enables

Measure detection quality using true-positive rate, false-positive rate, and mean time to triage, and state what each metric fails to capture

Tune three noisy rules by adjusting thresholds, adding allowlists, or converting to behavioral logic, documenting the before-and-after alert volume

Build a rule-testing loop using synthetic or replay data and define pass/fail criteria before deployment

Write a change log entry for a tuned rule that records rationale, expected impact, and rollback condition

Assemble a full practice review across all eight domains and score weak areas for the final week